← androux.org

Daily Ops Brief

An n8n workflow blueprint that orchestrates two systems I built and self-host: a morning brief assembled from my own infrastructure, with no credentials stored in the workflow.

n8n · blueprint Mneme · semantic memory hub Aegis · secrets broker + SSH CA 2026

Most workflow demos call two public SaaS APIs and a weather service. This one calls my own production services: Mneme, a self-built semantic memory hub (65 MCP tools, 30 REST endpoints, PostgreSQL/pgvector, 593 tests) that every agent in my homelab shares, and Aegis, my secrets broker and SSH certificate authority, which mints scoped, short-TTL, audited credentials at runtime.

The design point is the credential path: the workflow stores no service API keys. Its only credential is a single scoped broker key. Every run asks Aegis for a token, uses it once against Mneme, and lets it expire. Canary secrets in the broker tripwire-alert if anything reads what it shouldn't.

Lane 1 — the morning brief

schedule trigger
07:00 America/Chicago
Fires daily. Mornings are when the calendar, the furnace filter, and the backlog all want attention at once.
http request
Aegis: fetch scoped token
GET aegis.androux.org/v1/secret/mneme/api-token
Agent key in header; broker returns a scoped, audited, short-TTL credential.
http request
Mneme: GET /brief
Authorization: Bearer {{token}}
Returns calendar events, home-maintenance items due, and task-backlog health as JSON.
code · javascript
Compose brief
Formats today's calendar, maintenance due, and top backlog items, then renders a one-line verdict.
if
Anything on fire?
Checks for overdue P0/P1 items.
true ↓
http request
ntfy: priority push
Priority: high. The phone buzzes like it means it.
false ↓
http request
ntfy: morning push
"Calm seas. Suspiciously calm."

Lane 2 — brain-dump intake

webhook · header auth
POST /brain-dump
Free text in: "furnace filter Saturday, dentist Tuesday 2pm, buy salt for the softener."
http request
Aegis: fetch scoped token
Same broker path as lane 1. Both lanes mint at runtime; neither holds a service key.
http request
Mneme: POST /route
Mneme's router classifies each clause and files it into the right typed store: calendar, maintenance, household facts, or to-dos.
respond to webhook
Routing result
Echoes back what was filed where.
Secrets hygiene

No service API keys are stored in this workflow; its only credential is one scoped broker key. Aegis mints everything else at runtime, short-TTL and audited, and canary secrets tripwire-alert if anything reads what it shouldn't. The intake webhook is header-auth gated, and the ntfy topic stays an env placeholder: public ntfy.sh topics are world-writable.

Ops note

Same network philosophy as the rest of the homelab: LAN-only services, TLS via reverse proxy, nothing exposed to the internet. Which is also why this page is a blueprint rather than a public live demo. Root cause of most morning incidents remains: DNS. (It's always DNS.)

Artifacts